Yahoo's top lawyer has resigned and CEO Marissa Mayer was docked of her 2016 bonus following an internal investigation into the company's handling of massive hacks it experienced in 2014.

The investigation concluded that the company's executives did not properly respond to the security breaches in which a "state-sponsored actor" made off with phone numbers, names, and dates of birth of many Yahoo users.

Yahoo disclosed in its annual report on Wednesday that it could face criminal penalties in connection with the incident, as various government agencies look into the matter. Yahoo is also facing 43 putative consumer class-action lawsuits because of the hacks.

The hacks, which affected more than 1 billion users, were not publicly disclosed until late last year, after Yahoo had struck a deal to be acquired by Verizon. The revelation caused Verizon to lower the price of the deal by $350 million.

As a result of the investigation, CEO Marissa Mayer did not receive her expected cash bonus in 2016, worth up to $2 million. Mayer also voluntarily gave up her 2017 bonus and equity grants, the latter of which are required to be worth no less than $12 million a year under the terms of her employment contract. Yahoo's general counsel, Ronald S. Bell, also resigned from the company.

The company's internal investigation found that Yahoo's security team knew of the hacks, which compromised millions of user accounts, in as early as 2015. The attacks took place in 2014 but were not publicly disclosed until last year, when the company said it believed 500 million accounts were compromised.

The investigation also found that some Yahoo executives "did not properly comprehend or investigate" the attacks. The findings also make clear, however, that there was not an "intentional suppression of relevant information."

In other words, Yahoo did not intentionally hide the hacks from Verizon or its users before the sale.